CVE-2012-2386

Integer overflow in the phar_parse_tarfile function in tar.c in the phar extension in PHP before...

7.5 HighPublic exploitFix available

CVE-2012-2386 is a high vulnerability (CVSS 7.5) in Php, published June 10, 2012. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 42.5%, the 98th percentile. Fixed in php5 5.3.3-7+squeeze13.

Integer overflow in the phar_parse_tarfile function in tar.c in the phar extension in PHP before 5.3.14 and 5.4.x before 5.4.4 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted tar file that triggers a heap-based buffer overflow.

Exploit likelihood

42.5%Up 5.7 points since Feb 4, 2022

What each source reports

NVD Score used 7.5

Record: CVE-2012-2386
CVSS 2.0: 7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness: CWE-189
Updated: 2026-11-02

CVE List No score

Record: CVE-2012-2386
Updated: 2026-11-02

EUVDEUVD-2012-2374 No score

Record: EUVD-2012-2374
Updated: 2026-11-03

GitHub AdvisoriesGHSA-479m-5qr8-x9r6 No score

Integer overflow in the phar_parse_tarfile function in tar.c in the phar extension in PHP before...

Record: GHSA-479m-5qr8-x9r6
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`php5` Debian:6.0	before 5.3.3-7+squeeze13, plus listed versions 5.3.3-75.3.3-7+squeeze15.3.3-7+squeeze25.3.3-7+squeeze35.3.3-7+squeeze5 Show 4 moreShow less 5.3.3-7+squeeze65.3.3-7+squeeze75.3.3-7+squeeze85.3.3-7+squeeze9	5.3.3-7+squeeze13
`php` Red Hat:enterprise_linux:6::client	before 0:5.3.3-14.el6_3	0:5.3.3-14.el6_3
`php-bcmath` Red Hat:enterprise_linux:6::client	before 0:5.3.3-14.el6_3	0:5.3.3-14.el6_3
`php-cli` Red Hat:enterprise_linux:6::client	before 0:5.3.3-14.el6_3	0:5.3.3-14.el6_3
`php-common` Red Hat:enterprise_linux:6::client	before 0:5.3.3-14.el6_3	0:5.3.3-14.el6_3
`php-dba` Red Hat:enterprise_linux:6::client	before 0:5.3.3-14.el6_3	0:5.3.3-14.el6_3
`php-debuginfo` Red Hat:enterprise_linux:6::client	before 0:5.3.3-14.el6_3	0:5.3.3-14.el6_3
`php-devel` Red Hat:enterprise_linux:6::client	before 0:5.3.3-14.el6_3	0:5.3.3-14.el6_3
`php-embedded` Red Hat:enterprise_linux:6::client	before 0:5.3.3-14.el6_3	0:5.3.3-14.el6_3
`php-enchant` Red Hat:enterprise_linux:6::client	before 0:5.3.3-14.el6_3	0:5.3.3-14.el6_3

Show 143 moreShow less

Affected packages
Package	Affected	Fixed
`php-gd` Red Hat:enterprise_linux:6::client	before 0:5.3.3-14.el6_3	0:5.3.3-14.el6_3
`php-imap` Red Hat:enterprise_linux:6::client	before 0:5.3.3-14.el6_3	0:5.3.3-14.el6_3
`php-intl` Red Hat:enterprise_linux:6::client	before 0:5.3.3-14.el6_3	0:5.3.3-14.el6_3
`php-ldap` Red Hat:enterprise_linux:6::client	before 0:5.3.3-14.el6_3	0:5.3.3-14.el6_3
`php-mbstring` Red Hat:enterprise_linux:6::client	before 0:5.3.3-14.el6_3	0:5.3.3-14.el6_3
`php-mysql` Red Hat:enterprise_linux:6::client	before 0:5.3.3-14.el6_3	0:5.3.3-14.el6_3
`php-odbc` Red Hat:enterprise_linux:6::client	before 0:5.3.3-14.el6_3	0:5.3.3-14.el6_3
`php-pdo` Red Hat:enterprise_linux:6::client	before 0:5.3.3-14.el6_3	0:5.3.3-14.el6_3
`php-pgsql` Red Hat:enterprise_linux:6::client	before 0:5.3.3-14.el6_3	0:5.3.3-14.el6_3
`php-process` Red Hat:enterprise_linux:6::client	before 0:5.3.3-14.el6_3	0:5.3.3-14.el6_3
`php-pspell` Red Hat:enterprise_linux:6::client	before 0:5.3.3-14.el6_3	0:5.3.3-14.el6_3
`php-recode` Red Hat:enterprise_linux:6::client	before 0:5.3.3-14.el6_3	0:5.3.3-14.el6_3
`php-snmp` Red Hat:enterprise_linux:6::client	before 0:5.3.3-14.el6_3	0:5.3.3-14.el6_3
`php-soap` Red Hat:enterprise_linux:6::client	before 0:5.3.3-14.el6_3	0:5.3.3-14.el6_3
`php-tidy` Red Hat:enterprise_linux:6::client	before 0:5.3.3-14.el6_3	0:5.3.3-14.el6_3
`php-xml` Red Hat:enterprise_linux:6::client	before 0:5.3.3-14.el6_3	0:5.3.3-14.el6_3
`php-xmlrpc` Red Hat:enterprise_linux:6::client	before 0:5.3.3-14.el6_3	0:5.3.3-14.el6_3
`php-zts` Red Hat:enterprise_linux:6::client	before 0:5.3.3-14.el6_3	0:5.3.3-14.el6_3
`php` Red Hat:enterprise_linux:6::computenode	before 0:5.3.3-14.el6_3	0:5.3.3-14.el6_3
`php-cli` Red Hat:enterprise_linux:6::computenode	before 0:5.3.3-14.el6_3	0:5.3.3-14.el6_3
`php-common` Red Hat:enterprise_linux:6::computenode	before 0:5.3.3-14.el6_3	0:5.3.3-14.el6_3
`php-debuginfo` Red Hat:enterprise_linux:6::computenode	before 0:5.3.3-14.el6_3	0:5.3.3-14.el6_3
`php-bcmath` Red Hat:enterprise_linux:6::computenode	before 0:5.3.3-14.el6_3	0:5.3.3-14.el6_3
`php-dba` Red Hat:enterprise_linux:6::computenode	before 0:5.3.3-14.el6_3	0:5.3.3-14.el6_3
`php-devel` Red Hat:enterprise_linux:6::computenode	before 0:5.3.3-14.el6_3	0:5.3.3-14.el6_3
`php-embedded` Red Hat:enterprise_linux:6::computenode	before 0:5.3.3-14.el6_3	0:5.3.3-14.el6_3
`php-enchant` Red Hat:enterprise_linux:6::computenode	before 0:5.3.3-14.el6_3	0:5.3.3-14.el6_3
`php-gd` Red Hat:enterprise_linux:6::computenode	before 0:5.3.3-14.el6_3	0:5.3.3-14.el6_3
`php-imap` Red Hat:enterprise_linux:6::computenode	before 0:5.3.3-14.el6_3	0:5.3.3-14.el6_3
`php-intl` Red Hat:enterprise_linux:6::computenode	before 0:5.3.3-14.el6_3	0:5.3.3-14.el6_3
`php-ldap` Red Hat:enterprise_linux:6::computenode	before 0:5.3.3-14.el6_3	0:5.3.3-14.el6_3
`php-mbstring` Red Hat:enterprise_linux:6::computenode	before 0:5.3.3-14.el6_3	0:5.3.3-14.el6_3
`php-mysql` Red Hat:enterprise_linux:6::computenode	before 0:5.3.3-14.el6_3	0:5.3.3-14.el6_3
`php-odbc` Red Hat:enterprise_linux:6::computenode	before 0:5.3.3-14.el6_3	0:5.3.3-14.el6_3
`php-pdo` Red Hat:enterprise_linux:6::computenode	before 0:5.3.3-14.el6_3	0:5.3.3-14.el6_3
`php-pgsql` Red Hat:enterprise_linux:6::computenode	before 0:5.3.3-14.el6_3	0:5.3.3-14.el6_3
`php-process` Red Hat:enterprise_linux:6::computenode	before 0:5.3.3-14.el6_3	0:5.3.3-14.el6_3
`php-pspell` Red Hat:enterprise_linux:6::computenode	before 0:5.3.3-14.el6_3	0:5.3.3-14.el6_3
`php-recode` Red Hat:enterprise_linux:6::computenode	before 0:5.3.3-14.el6_3	0:5.3.3-14.el6_3
`php-snmp` Red Hat:enterprise_linux:6::computenode	before 0:5.3.3-14.el6_3	0:5.3.3-14.el6_3
`php-soap` Red Hat:enterprise_linux:6::computenode	before 0:5.3.3-14.el6_3	0:5.3.3-14.el6_3
`php-tidy` Red Hat:enterprise_linux:6::computenode	before 0:5.3.3-14.el6_3	0:5.3.3-14.el6_3
`php-xml` Red Hat:enterprise_linux:6::computenode	before 0:5.3.3-14.el6_3	0:5.3.3-14.el6_3
`php-xmlrpc` Red Hat:enterprise_linux:6::computenode	before 0:5.3.3-14.el6_3	0:5.3.3-14.el6_3
`php-zts` Red Hat:enterprise_linux:6::computenode	before 0:5.3.3-14.el6_3	0:5.3.3-14.el6_3
`php` Red Hat:enterprise_linux:6::server	before 0:5.3.3-14.el6_3	0:5.3.3-14.el6_3
`php-cli` Red Hat:enterprise_linux:6::server	before 0:5.3.3-14.el6_3	0:5.3.3-14.el6_3
`php-common` Red Hat:enterprise_linux:6::server	before 0:5.3.3-14.el6_3	0:5.3.3-14.el6_3
`php-debuginfo` Red Hat:enterprise_linux:6::server	before 0:5.3.3-14.el6_3	0:5.3.3-14.el6_3
`php-gd` Red Hat:enterprise_linux:6::server	before 0:5.3.3-14.el6_3	0:5.3.3-14.el6_3
`php-ldap` Red Hat:enterprise_linux:6::server	before 0:5.3.3-14.el6_3	0:5.3.3-14.el6_3
`php-mysql` Red Hat:enterprise_linux:6::server	before 0:5.3.3-14.el6_3	0:5.3.3-14.el6_3
`php-odbc` Red Hat:enterprise_linux:6::server	before 0:5.3.3-14.el6_3	0:5.3.3-14.el6_3
`php-pdo` Red Hat:enterprise_linux:6::server	before 0:5.3.3-14.el6_3	0:5.3.3-14.el6_3
`php-pgsql` Red Hat:enterprise_linux:6::server	before 0:5.3.3-14.el6_3	0:5.3.3-14.el6_3
`php-soap` Red Hat:enterprise_linux:6::server	before 0:5.3.3-14.el6_3	0:5.3.3-14.el6_3
`php-xml` Red Hat:enterprise_linux:6::server	before 0:5.3.3-14.el6_3	0:5.3.3-14.el6_3
`php-xmlrpc` Red Hat:enterprise_linux:6::server	before 0:5.3.3-14.el6_3	0:5.3.3-14.el6_3
`php-bcmath` Red Hat:enterprise_linux:6::server	before 0:5.3.3-14.el6_3	0:5.3.3-14.el6_3
`php-dba` Red Hat:enterprise_linux:6::server	before 0:5.3.3-14.el6_3	0:5.3.3-14.el6_3
`php-devel` Red Hat:enterprise_linux:6::server	before 0:5.3.3-14.el6_3	0:5.3.3-14.el6_3
`php-embedded` Red Hat:enterprise_linux:6::server	before 0:5.3.3-14.el6_3	0:5.3.3-14.el6_3
`php-enchant` Red Hat:enterprise_linux:6::server	before 0:5.3.3-14.el6_3	0:5.3.3-14.el6_3
`php-imap` Red Hat:enterprise_linux:6::server	before 0:5.3.3-14.el6_3	0:5.3.3-14.el6_3
`php-intl` Red Hat:enterprise_linux:6::server	before 0:5.3.3-14.el6_3	0:5.3.3-14.el6_3
`php-mbstring` Red Hat:enterprise_linux:6::server	before 0:5.3.3-14.el6_3	0:5.3.3-14.el6_3
`php-process` Red Hat:enterprise_linux:6::server	before 0:5.3.3-14.el6_3	0:5.3.3-14.el6_3
`php-pspell` Red Hat:enterprise_linux:6::server	before 0:5.3.3-14.el6_3	0:5.3.3-14.el6_3
`php-recode` Red Hat:enterprise_linux:6::server	before 0:5.3.3-14.el6_3	0:5.3.3-14.el6_3
`php-snmp` Red Hat:enterprise_linux:6::server	before 0:5.3.3-14.el6_3	0:5.3.3-14.el6_3
`php-tidy` Red Hat:enterprise_linux:6::server	before 0:5.3.3-14.el6_3	0:5.3.3-14.el6_3
`php-zts` Red Hat:enterprise_linux:6::server	before 0:5.3.3-14.el6_3	0:5.3.3-14.el6_3
`php` Red Hat:enterprise_linux:6::workstation	before 0:5.3.3-14.el6_3	0:5.3.3-14.el6_3
`php-cli` Red Hat:enterprise_linux:6::workstation	before 0:5.3.3-14.el6_3	0:5.3.3-14.el6_3
`php-common` Red Hat:enterprise_linux:6::workstation	before 0:5.3.3-14.el6_3	0:5.3.3-14.el6_3
`php-debuginfo` Red Hat:enterprise_linux:6::workstation	before 0:5.3.3-14.el6_3	0:5.3.3-14.el6_3
`php-gd` Red Hat:enterprise_linux:6::workstation	before 0:5.3.3-14.el6_3	0:5.3.3-14.el6_3
`php-ldap` Red Hat:enterprise_linux:6::workstation	before 0:5.3.3-14.el6_3	0:5.3.3-14.el6_3
`php-mysql` Red Hat:enterprise_linux:6::workstation	before 0:5.3.3-14.el6_3	0:5.3.3-14.el6_3
`php-odbc` Red Hat:enterprise_linux:6::workstation	before 0:5.3.3-14.el6_3	0:5.3.3-14.el6_3
`php-pdo` Red Hat:enterprise_linux:6::workstation	before 0:5.3.3-14.el6_3	0:5.3.3-14.el6_3
`php-pgsql` Red Hat:enterprise_linux:6::workstation	before 0:5.3.3-14.el6_3	0:5.3.3-14.el6_3
`php-soap` Red Hat:enterprise_linux:6::workstation	before 0:5.3.3-14.el6_3	0:5.3.3-14.el6_3
`php-xml` Red Hat:enterprise_linux:6::workstation	before 0:5.3.3-14.el6_3	0:5.3.3-14.el6_3
`php-xmlrpc` Red Hat:enterprise_linux:6::workstation	before 0:5.3.3-14.el6_3	0:5.3.3-14.el6_3
`php-bcmath` Red Hat:enterprise_linux:6::workstation	before 0:5.3.3-14.el6_3	0:5.3.3-14.el6_3
`php-dba` Red Hat:enterprise_linux:6::workstation	before 0:5.3.3-14.el6_3	0:5.3.3-14.el6_3
`php-devel` Red Hat:enterprise_linux:6::workstation	before 0:5.3.3-14.el6_3	0:5.3.3-14.el6_3
`php-embedded` Red Hat:enterprise_linux:6::workstation	before 0:5.3.3-14.el6_3	0:5.3.3-14.el6_3
`php-enchant` Red Hat:enterprise_linux:6::workstation	before 0:5.3.3-14.el6_3	0:5.3.3-14.el6_3
`php-imap` Red Hat:enterprise_linux:6::workstation	before 0:5.3.3-14.el6_3	0:5.3.3-14.el6_3
`php-intl` Red Hat:enterprise_linux:6::workstation	before 0:5.3.3-14.el6_3	0:5.3.3-14.el6_3
`php-mbstring` Red Hat:enterprise_linux:6::workstation	before 0:5.3.3-14.el6_3	0:5.3.3-14.el6_3
`php-process` Red Hat:enterprise_linux:6::workstation	before 0:5.3.3-14.el6_3	0:5.3.3-14.el6_3
`php-pspell` Red Hat:enterprise_linux:6::workstation	before 0:5.3.3-14.el6_3	0:5.3.3-14.el6_3
`php-recode` Red Hat:enterprise_linux:6::workstation	before 0:5.3.3-14.el6_3	0:5.3.3-14.el6_3
`php-snmp` Red Hat:enterprise_linux:6::workstation	before 0:5.3.3-14.el6_3	0:5.3.3-14.el6_3
`php-tidy` Red Hat:enterprise_linux:6::workstation	before 0:5.3.3-14.el6_3	0:5.3.3-14.el6_3
`php-zts` Red Hat:enterprise_linux:6::workstation	before 0:5.3.3-14.el6_3	0:5.3.3-14.el6_3
`php53` Red Hat:enterprise_linux:5::client_workstation	before 0:5.3.3-13.el5_8	0:5.3.3-13.el5_8
`php53-bcmath` Red Hat:enterprise_linux:5::client_workstation	before 0:5.3.3-13.el5_8	0:5.3.3-13.el5_8
`php53-cli` Red Hat:enterprise_linux:5::client_workstation	before 0:5.3.3-13.el5_8	0:5.3.3-13.el5_8
`php53-common` Red Hat:enterprise_linux:5::client_workstation	before 0:5.3.3-13.el5_8	0:5.3.3-13.el5_8
`php53-dba` Red Hat:enterprise_linux:5::client_workstation	before 0:5.3.3-13.el5_8	0:5.3.3-13.el5_8
`php53-debuginfo` Red Hat:enterprise_linux:5::client_workstation	before 0:5.3.3-13.el5_8	0:5.3.3-13.el5_8
`php53-devel` Red Hat:enterprise_linux:5::client_workstation	before 0:5.3.3-13.el5_8	0:5.3.3-13.el5_8
`php53-gd` Red Hat:enterprise_linux:5::client_workstation	before 0:5.3.3-13.el5_8	0:5.3.3-13.el5_8
`php53-imap` Red Hat:enterprise_linux:5::client_workstation	before 0:5.3.3-13.el5_8	0:5.3.3-13.el5_8
`php53-intl` Red Hat:enterprise_linux:5::client_workstation	before 0:5.3.3-13.el5_8	0:5.3.3-13.el5_8
`php53-ldap` Red Hat:enterprise_linux:5::client_workstation	before 0:5.3.3-13.el5_8	0:5.3.3-13.el5_8
`php53-mbstring` Red Hat:enterprise_linux:5::client_workstation	before 0:5.3.3-13.el5_8	0:5.3.3-13.el5_8
`php53-mysql` Red Hat:enterprise_linux:5::client_workstation	before 0:5.3.3-13.el5_8	0:5.3.3-13.el5_8
`php53-odbc` Red Hat:enterprise_linux:5::client_workstation	before 0:5.3.3-13.el5_8	0:5.3.3-13.el5_8
`php53-pdo` Red Hat:enterprise_linux:5::client_workstation	before 0:5.3.3-13.el5_8	0:5.3.3-13.el5_8
`php53-pgsql` Red Hat:enterprise_linux:5::client_workstation	before 0:5.3.3-13.el5_8	0:5.3.3-13.el5_8
`php53-process` Red Hat:enterprise_linux:5::client_workstation	before 0:5.3.3-13.el5_8	0:5.3.3-13.el5_8
`php53-pspell` Red Hat:enterprise_linux:5::client_workstation	before 0:5.3.3-13.el5_8	0:5.3.3-13.el5_8
`php53-snmp` Red Hat:enterprise_linux:5::client_workstation	before 0:5.3.3-13.el5_8	0:5.3.3-13.el5_8
`php53-soap` Red Hat:enterprise_linux:5::client_workstation	before 0:5.3.3-13.el5_8	0:5.3.3-13.el5_8
`php53-xml` Red Hat:enterprise_linux:5::client_workstation	before 0:5.3.3-13.el5_8	0:5.3.3-13.el5_8
`php53-xmlrpc` Red Hat:enterprise_linux:5::client_workstation	before 0:5.3.3-13.el5_8	0:5.3.3-13.el5_8
`php53` Red Hat:enterprise_linux:5::server	before 0:5.3.3-13.el5_8	0:5.3.3-13.el5_8
`php53-bcmath` Red Hat:enterprise_linux:5::server	before 0:5.3.3-13.el5_8	0:5.3.3-13.el5_8
`php53-cli` Red Hat:enterprise_linux:5::server	before 0:5.3.3-13.el5_8	0:5.3.3-13.el5_8
`php53-common` Red Hat:enterprise_linux:5::server	before 0:5.3.3-13.el5_8	0:5.3.3-13.el5_8
`php53-dba` Red Hat:enterprise_linux:5::server	before 0:5.3.3-13.el5_8	0:5.3.3-13.el5_8
`php53-debuginfo` Red Hat:enterprise_linux:5::server	before 0:5.3.3-13.el5_8	0:5.3.3-13.el5_8
`php53-devel` Red Hat:enterprise_linux:5::server	before 0:5.3.3-13.el5_8	0:5.3.3-13.el5_8
`php53-gd` Red Hat:enterprise_linux:5::server	before 0:5.3.3-13.el5_8	0:5.3.3-13.el5_8
`php53-imap` Red Hat:enterprise_linux:5::server	before 0:5.3.3-13.el5_8	0:5.3.3-13.el5_8
`php53-intl` Red Hat:enterprise_linux:5::server	before 0:5.3.3-13.el5_8	0:5.3.3-13.el5_8
`php53-ldap` Red Hat:enterprise_linux:5::server	before 0:5.3.3-13.el5_8	0:5.3.3-13.el5_8
`php53-mbstring` Red Hat:enterprise_linux:5::server	before 0:5.3.3-13.el5_8	0:5.3.3-13.el5_8
`php53-mysql` Red Hat:enterprise_linux:5::server	before 0:5.3.3-13.el5_8	0:5.3.3-13.el5_8
`php53-odbc` Red Hat:enterprise_linux:5::server	before 0:5.3.3-13.el5_8	0:5.3.3-13.el5_8
`php53-pdo` Red Hat:enterprise_linux:5::server	before 0:5.3.3-13.el5_8	0:5.3.3-13.el5_8
`php53-pgsql` Red Hat:enterprise_linux:5::server	before 0:5.3.3-13.el5_8	0:5.3.3-13.el5_8
`php53-process` Red Hat:enterprise_linux:5::server	before 0:5.3.3-13.el5_8	0:5.3.3-13.el5_8
`php53-pspell` Red Hat:enterprise_linux:5::server	before 0:5.3.3-13.el5_8	0:5.3.3-13.el5_8
`php53-snmp` Red Hat:enterprise_linux:5::server	before 0:5.3.3-13.el5_8	0:5.3.3-13.el5_8
`php53-soap` Red Hat:enterprise_linux:5::server	before 0:5.3.3-13.el5_8	0:5.3.3-13.el5_8
`php53-xml` Red Hat:enterprise_linux:5::server	before 0:5.3.3-13.el5_8	0:5.3.3-13.el5_8
`php53-xmlrpc` Red Hat:enterprise_linux:5::server	before 0:5.3.3-13.el5_8	0:5.3.3-13.el5_8

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	PHP 'phar' Extension 1.1.1 - Heap Overflow	2011-04-22

History

History
When	Changed	Sources
2026-11-03	aliases	EUVD
2026-11-02	created	CVE List, Exploit-DB, GitHub Advisories, NVD, OSV

References

Show 47 moreShow less